Week of August 3, 2026: CISA's six-flaw KEV sprint and a new Dallas CISO

Security leaders tracked four separate CISA Known Exploited Vulnerabilities Catalog updates between August 3 and August 7, 2026, covering six actively exploited flaws in Progress LoadMaster, JetBrains TeamCity, IBM Langflow, N-able N-central, and Apache Tomcat. The City of Dallas also named a new Chief Information Security Officer during the week, James Wilkinson, a US Army Cyber Command veteran with prior roles at MUFG, Lockheed Martin, and Wells Fargo.

CISA Adds Exploited Progress LoadMaster Flaw to KEV Catalog

CISA added a newly identified vulnerability to its Known Exploited Vulnerabilities Catalog on August 7, 2026, citing a command injection flaw in Progress LoadMaster tracked as CVE-2026-8037. The agency noted this class of vulnerability is a frequent attack vector against federal systems and reiterated that Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of catalog entries found on internet-facing assets. CISA encouraged all organizations, not just federal agencies, to adopt the same risk-based remediation approach. (CISA)

JetBrains TeamCity Deserialization Bug Added to CISA's Exploited List

On August 5, 2026, CISA added CVE-2026-63077, a deserialization of untrusted data vulnerability in JetBrains TeamCity, to its Known Exploited Vulnerabilities Catalog based on observed active exploitation. CISA pointed to Binding Operational Directive 26-04 as the basis for requiring Federal Civilian Executive Branch agencies to remediate such high-risk, internet-exposed flaws on an accelerated timeline, while urging all organizations to adopt the same risk-based patching priority for this build-server vulnerability. (CISA)

CISA Flags Three Actively Exploited Bugs in Langflow, N-able, and Tomcat

CISA's August 4, 2026 catalog update added three vulnerabilities with confirmed active exploitation: a code injection flaw in IBM Langflow (CVE-2026-9198), an authentication bypass in N-able N-central (CVE-2026-18556), and a missing-encryption weakness in Apache Tomcat (CVE-2026-34486). The agency again cited Binding Operational Directive 26-04, which requires federal civilian agencies to remediate catalog vulnerabilities granting total control of exposed assets and to check for prior compromise before applying patches. (CISA)

Second N-able N-central Authentication Bypass Added to KEV Catalog

CISA opened the week by adding CVE-2026-18577, an authentication bypass using an alternate path or channel in N-able N-central, to its Known Exploited Vulnerabilities Catalog on August 3, 2026, based on evidence of active exploitation. The addition came one day before a second N-able N-central flaw, CVE-2026-18556, was also added, underscoring continued targeting of the remote monitoring and management platform during the first days of August. (CISA)

City of Dallas Names James Wilkinson as Chief Information Security Officer

SecurityWeek's industry-moves roundup for the week of August 3, 2026 reported that James Wilkinson was named Chief Information Security Officer for the City of Dallas. Wilkinson, a US Army Cyber Command veteran, previously served as CEO at Ethan Solutions Inc. and held cybersecurity leadership roles at MUFG, Lockheed Martin, and Wells Fargo before taking on the municipal CISO post. (SecurityWeek)